Keep rejected applications for three years

Q. I read in your publication that if an applicant isn't hired, we should retain the application for at least three years. I've heard elsewhere that applications should be kept for only one year beyond the date the position is filled. Have the rules changed? —S.C., Washington